GDPRChecker

Home / Knowledge Base / Didomi Consent Mode v2 Verification Guide: Ensure GDPR Compliance with Confidence

Website Compliance

Didomi Consent Mode v2 Verification Guide: Ensure GDPR Compliance with Confidence

A practical guide for website owners to verify Didomi Consent Mode v2 implementation, covering step-by-step checks, common mistakes, and how to use GDPRChecker for ongoing compliance.

Author

GDPRChecker Editorial Team

Reviewed by

Privacy & Compliance Research Team

Last updated

August 2026

Reading time

13 min read

Educational guidance for compliance readiness — not legal advice. Requirements vary by jurisdiction and your specific processing activities.

Introduction

*Updated for 2026 compliance practices.*

Didomi consent mode v2 verification guide is a practical compliance topic for website owners validating consent, tags, and disclosures. As digital privacy regulations tighten, ensuring your consent management platform (CMP) works correctly with Google Consent Mode v2 is critical. This guide walks you through verifying your Didomi setup, avoiding common pitfalls, and using GDPRChecker to confirm everything is in order. We focus on technical implementation steps, not legal advice, so you can confidently manage your compliance posture.

Why Verification Matters for GDPR Compliance

Under the GDPR, consent must be freely given, specific, informed, and unambiguous. Consent Mode v2 helps operationalize these principles by adjusting tag behavior based on user consent. However, misconfigurations can lead to non-compliance, such as tracking before consent or failing to respect opt-out choices. Verification closes the gap between your intended setup and actual behavior.

Regulators like the European Data Protection Board (EDPB) emphasize accountability—you must be able to demonstrate compliance. Regular verification provides evidence that your consent mechanisms work as designed. It also protects your data accuracy: without proper consent signals, Google Analytics 4 may model data based on incomplete information, skewing your insights.

Common risks of unverified implementations include: - Tags firing on page load before the consent banner appears. - Consent defaults incorrectly set to 'granted', leading to unauthorized data collection. - Broken reject flows where opting out still allows tracking. - Missing or outdated cookie disclosures in your privacy policy.

By systematically verifying your Didomi Consent Mode v2 setup, you mitigate these risks and build a defensible compliance posture.

Step-by-Step Implementation Verification

Follow these steps to verify your Didomi Consent Mode v2 implementation. We recommend using GDPRChecker’s scanning tools alongside manual checks for comprehensive coverage.

1. Confirm Didomi Script Installation Ensure the Didomi CMP script is correctly installed on every page. The script should load early in the `<head>` to set default consent states before any tags fire. Check for: - The Didomi SDK script tag with your unique API key. - No JavaScript errors in the browser console related to Didomi. - The script loading over HTTPS.

Use GDPRChecker’s site scan to confirm the script is detected and that no tags fire before the CMP initializes.

2. Verify Default Consent States Google Consent Mode v2 requires default consent to be 'denied' for all storage types until the user makes a choice. In your Didomi configuration, confirm that the default consent for `analytics_storage`, `ad_storage`, `ad_user_data`, and `ad_personalization` is set to 'denied'. You can test this by: - Opening your website in an incognito window. - Before interacting with the banner, open the browser console and type `google_tag_data.ics.entries` to inspect consent states. - All entries should show `'denied'`.

If any default to `'granted'`, adjust your Didomi settings or tag manager triggers.

3. Test Consent Banner Interaction Interact with the consent banner to verify that consent updates are correctly communicated. Test both 'Accept All' and 'Reject All' flows: - **Accept All**: After clicking, check that consent states update to `'granted'` for all purposes. Tags like Google Analytics 4 should start sending data. - **Reject All**: After clicking, consent states should remain `'denied'`. Tags should not fire, or they should use cookieless pings if configured.

Use GDPRChecker’s pre-consent request scanner to confirm no network requests to Google domains occur before consent is given.

4. Validate Tag Manager Triggers If you use Google Tag Manager (GTM), ensure your triggers respect consent. For Consent Mode v2, you typically use the built-in consent triggers or custom events. Verify: - Tags that require consent have appropriate consent checks (e.g., “Consent Initialized” trigger). - No tags fire on “All Pages” without a consent condition. - Custom HTML tags do not bypass consent checks.

GDPRChecker can scan for tags that fire prematurely and flag them in the report.

5. Check Policy and Disclosure Links Your cookie banner must link to a compliant privacy policy and cookie policy. Verify: - The banner includes clear links to both policies. - The policies list all cookies and trackers in use, including those from Google services. - The policies explain how consent is managed and how users can withdraw consent.

GDPRChecker’s scanner checks for the presence of these links and can crawl your policies for completeness.

6. Test Across Browsers and Devices Consent behavior can vary across browsers due to differences in cookie handling, JavaScript execution, and privacy settings. Test your implementation on: - Chrome, Firefox, Safari, and Edge. - Mobile and desktop views. - Incognito/private browsing modes.

Pay special attention to Safari’s Intelligent Tracking Prevention (ITP), which may affect cookie persistence and consent signals.

7. Monitor for Changes Over Time Websites evolve—new tags are added, scripts are updated, and configurations drift. Set up recurring scans with GDPRChecker to detect changes in consent behavior. Automated monitoring can alert you to: - New tags firing without consent. - Consent banner failures. - Missing policy links.

This ongoing verification is key to maintaining compliance.

Common Mistakes and How to Avoid Them

Even with a certified CMP like Didomi, mistakes happen. Here are the most frequent issues we see and how to prevent them.

Mistake 1: Default Consent Set to 'Granted' This is the most critical error. If default consent is 'granted', tags fire before the user has a chance to consent, violating GDPR. Always set defaults to 'denied' in your Didomi configuration and verify with the console check described above.

Mistake 2: Tags Firing Before Consent Banner Loads If your GTM container or other scripts load before Didomi, they may fire without consent. Ensure Didomi’s script is placed as high as possible in the `<head>`, and use GTM’s consent initialization trigger to delay tags.

Mistake 3: Incomplete Reject Flow Some implementations only handle 'Accept All' correctly. When a user rejects, tags may still fire because triggers are not properly conditioned. Test the reject flow thoroughly and use GDPRChecker to confirm no unwanted requests.

Mistake 4: Missing or Outdated Cookie Disclosures Your privacy policy must accurately reflect the cookies and trackers in use. If you add new Google services (e.g., Google Ads remarketing), update your policy. GDPRChecker’s cookie inventory feature can help you maintain an up-to-date list.

Mistake 5: Ignoring Regional Variations If your site serves users in multiple regions, consent requirements may differ. Didomi allows geo-targeting, but you must verify that the correct banner and consent settings apply per region.

Mistake 6: Not Testing After Updates Every time you update Didomi, GTM, or your website, re-verify consent mode. A simple plugin update can break consent flows.

How to Validate with GDPRChecker

GDPRChecker provides a comprehensive scanning suite to validate your Didomi Consent Mode v2 implementation. Here’s how to use it effectively:

  1. **Run a Full Site Scan**: Enter your URL and let GDPRChecker crawl your pages. It will detect the Didomi CMP, list all cookies and trackers, and check consent banner behavior.
  2. **Check Pre-Consent Requests**: The scanner identifies network requests made before user consent. Look for any requests to Google domains (e.g., `google-analytics.com`, `doubleclick.net`) that occur before the consent banner is interacted with.
  3. **Verify Consent Banner Presence**: GDPRChecker confirms that a consent banner is present and that it blocks tags until consent is given.
  4. **Audit Policy Links**: The scanner checks for links to your privacy policy and cookie policy from the banner and reports if they are missing or broken.
  5. **Review Cookie Inventory**: Get a detailed list of all cookies set by your site, including their domain, duration, and purpose. Cross-reference this with your disclosures.
  6. **Schedule Recurring Scans**: Set up weekly or monthly scans to catch compliance drift. GDPRChecker will alert you to new tags, missing banners, or consent changes.

For advanced users, GDPRChecker’s paid plans offer managed consent banner monitoring, runtime protection, and consent record keeping—providing an evidence trail for regulatory inquiries.

Real-World Examples of Verification in Action

Example 1: E-commerce Site with Google Ads An online retailer uses Didomi with Google Ads conversion tracking. During verification, GDPRChecker flagged that the Ads tag was firing on page load before consent. The issue: the GTM trigger was set to “All Pages” without a consent condition. After adding a consent initialization trigger, the tag only fired after user consent, and subsequent scans confirmed compliance.

Example 2: News Publisher with Google Analytics 4 A news site noticed a drop in GA4 reported users after implementing Didomi. Verification revealed that default consent was correctly set to 'denied', but the GA4 tag was not configured to send cookieless pings. This meant no data was collected for users who rejected consent. By enabling consent mode pings in GA4, the site regained modeled data for non-consenting users while respecting their choices.

Example 3: SaaS Platform with Multiple Subdomains A SaaS company with a main site and a blog subdomain used Didomi across both. Verification showed that the blog subdomain had a different GTM container that lacked consent triggers. GDPRChecker’s multi-page scan caught the inconsistency, and the team unified their GTM setup, ensuring consistent consent behavior.

Implementation Checklist

Use this checklist to systematically verify your Didomi Consent Mode v2 implementation:

  1. Didomi script is installed on all pages and loads before any tags.
  2. Default consent states for `analytics_storage`, `ad_storage`, `ad_user_data`, and `ad_personalization` are set to 'denied'.
  3. Consent banner appears on first visit and blocks tags until interaction.
  4. 'Accept All' updates consent states to 'granted' and tags fire accordingly.
  5. 'Reject All' keeps consent states as 'denied' and tags do not fire (or use cookieless pings).
  6. Privacy policy and cookie policy links are present and functional on the banner.
  7. Cookie disclosures in policies match the actual cookies found by GDPRChecker scan.
  8. Google Tag Manager triggers include consent checks for all relevant tags.
  9. No network requests to Google domains occur before consent in incognito tests.
  10. Implementation works consistently across Chrome, Firefox, Safari, and Edge.
  11. Mobile and desktop experiences are both verified.
  12. Recurring GDPRChecker scans are scheduled to monitor for changes.

FAQ

What is Didomi consent mode v2 verification guide? It is a practical resource for website owners to confirm that their Didomi CMP correctly implements Google Consent Mode v2. The guide covers step-by-step checks, common mistakes, and how to use GDPRChecker for validation, ensuring that consent signals are properly managed for GDPR compliance.

Do I need Didomi consent mode v2 verification guide for GDPR? Yes, if you use Didomi and Google services subject to GDPR. Verification ensures that user consent is respected and that tags do not fire without permission. It helps you demonstrate accountability and avoid non-compliance risks, such as unauthorized data collection.

How do I implement Didomi consent mode v2 verification guide? Start by installing the Didomi script correctly, setting default consent to 'denied', and testing banner interactions. Use browser developer tools to inspect consent states and GDPRChecker to scan for pre-consent requests. Follow the step-by-step verification process outlined in this guide.

How can I verify Didomi consent mode v2 verification guide with a scanner? Use GDPRChecker to run a full site scan. It checks for the Didomi CMP, pre-consent network requests, banner behavior, and policy links. The scanner provides a detailed report highlighting any issues, such as tags firing prematurely or missing disclosures.

What are common Didomi consent mode v2 verification guide mistakes? Common mistakes include default consent set to 'granted', tags firing before the banner loads, incomplete reject flows, outdated cookie disclosures, and not testing after updates. Regular verification with GDPRChecker helps catch and fix these errors.

Which cookies and trackers should I check for Didomi consent mode v2 verification guide? Focus on Google-related cookies and trackers, such as those from Google Analytics 4, Google Ads, and DoubleClick. Also, check any third-party tags that may fire based on consent. GDPRChecker’s cookie inventory lists all detected cookies for cross-referencing with your disclosures.

How often should I review Didomi consent mode v2 verification guide? Review your implementation whenever you update Didomi, GTM, or your website. Additionally, schedule recurring scans (e.g., weekly or monthly) with GDPRChecker to catch configuration drift. Regular reviews are essential for ongoing compliance.

What evidence should I keep for Didomi consent mode v2 verification guide? Keep records of your verification scans, consent banner configurations, and any changes made. GDPRChecker’s paid plans offer consent records and monitoring logs, which serve as evidence of your compliance efforts in case of a regulatory inquiry.

Next Steps for Ongoing Compliance

Verifying your Didomi Consent Mode v2 setup is not a one-off project. As your site evolves, so do compliance requirements. Make verification a routine part of your operations. Use GDPRChecker to automate scans and catch issues early. For deeper insights, explore our related guides:

  • Understand the broader context with our [Google Consent Mode v2 guide](/guides/google-consent-mode-v2-guide).
  • Ensure your analytics setup is compliant with [Google Analytics GDPR compliance](/guides/google-analytics-gdpr-compliance).
  • Learn about the differences between [Consent Mode v2 and Google Certified CMPs](/guides/consent-mode-v2-vs-google-certified-cmp).
  • If you’re unsure about needing a CMP, read [Do I need a CMP if I do not run Google Ads?](/guides/do-i-need-a-cmp-if-i-do-not-run-google-ads).
  • Use our [Google Consent Mode v2 checker](/guides/google-consent-mode-v2-checker) for quick diagnostics.
  • Review [cookie banner requirements](/guides/cookie-banner-requirements) to ensure your banner meets legal standards.

Ready to verify your Didomi implementation? Run a free scan with GDPRChecker now and close the consent mode gap for good.

Next step

Run a GDPRChecker scan to validate consent behavior, trackers, and disclosures after you implement the checklist above.

Article schema

```json { "@context": "https://schema.org", "@type": "Article", "headline": "Didomi Consent Mode v2 Verification Guide: Ensure GDPR Compliance with Confidence", "description": "Learn how to verify Didomi Consent Mode v2 implementation for GDPR compliance. Step-by-step guide with scanner checks, common mistakes, and a practical checklist.", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://www.gdprchecker.online/guides/didomi-consent-mode-v2-verification-guide" }, "publisher": { "@type": "Organization", "name": "GDPRChecker", "url": "https://www.gdprchecker.online" } } ```

GDPRChecker guides are educational resources and do not constitute legal advice. Use them to understand technical and operational privacy requirements, and consult qualified counsel for legal interpretation.

Check Your Website in Under 60 Seconds

  • No signup required
  • GDPR-focused checks
  • Cookie banner detection
  • Privacy policy verification
Run Free ScanView Pricing